diff --git a/services/frontend/README.md b/services/frontend/README.md
index 65b09be7a9..c493388722 100644
--- a/services/frontend/README.md
+++ b/services/frontend/README.md
@@ -134,3 +134,11 @@ For public accessible writable shares, a password can be enforced. To change the
 Note that changing this environment variable only makes sense if\
 `OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD`\
 is set to `false`.
+
+## Server Managed Spaces
+
+The `frontend` service can announce that the membership of spaces is managed by the server instead of by users. To enable this, set the following environment variable to `true`:
+
+`OC_CLAIM_MANAGED_SPACES_ENABLED`
+
+When enabled, the `spaces` capability contains `server_managed: true`. Clients like the web UI evaluate this capability and block adding or removing users to or from spaces.
diff --git a/services/frontend/pkg/config/config.go b/services/frontend/pkg/config/config.go
index bceda65970..1bc358f4d2 100644
--- a/services/frontend/pkg/config/config.go
+++ b/services/frontend/pkg/config/config.go
@@ -61,6 +61,8 @@ type Config struct {
 
 	ConfigurableNotifications bool `yaml:"configurable_notifications" env:"FRONTEND_CONFIGURABLE_NOTIFICATIONS" desc:"Allow configuring notifications via web client." introductionVersion:"1.0.0"`
 
+	ServerManagedSpaces bool `yaml:"server_managed_spaces" env:"OC_CLAIM_MANAGED_SPACES_ENABLED" desc:"Mark spaces as managed by the server. Clients like the web UI then block adding or removing users to or from spaces. See the text description for more details." introductionVersion:"%%NEXT%%"`
+
 	Groupware Groupware `yaml:"groupware"`
 
 	Context context.Context `yaml:"-"`
diff --git a/services/frontend/pkg/revaconfig/config.go b/services/frontend/pkg/revaconfig/config.go
index 537b14524c..989661adce 100644
--- a/services/frontend/pkg/revaconfig/config.go
+++ b/services/frontend/pkg/revaconfig/config.go
@@ -296,12 +296,13 @@ func FrontendConfigFromStruct(cfg *config.Config, logger log.Logger) (map[string
 								},
 							},
 							"spaces": map[string]any{
-								"version":       "1.0.0",
-								"enabled":       true,
-								"projects":      true,
-								"share_jail":    true,
-								"max_quota":     cfg.MaxQuota,
-								"default_quota": parseQuota(cfg.DefaultQuota),
+								"version":        "1.0.0",
+								"enabled":        true,
+								"projects":       true,
+								"share_jail":     true,
+								"max_quota":      cfg.MaxQuota,
+								"default_quota":  parseQuota(cfg.DefaultQuota),
+								"server_managed": cfg.ServerManagedSpaces,
 							},
 							"theme": capabilities.Default().Theme,
 							"search": map[string]any{
diff --git a/services/frontend/pkg/revaconfig/config_test.go b/services/frontend/pkg/revaconfig/config_test.go
index fbaf731150..df8656e4d8 100644
--- a/services/frontend/pkg/revaconfig/config_test.go
+++ b/services/frontend/pkg/revaconfig/config_test.go
@@ -24,6 +24,20 @@ func TestContentSearchCapabilityFollowsFullTextSearch(t *testing.T) {
 	}
 }
 
+func TestServerManagedCapabilityFollowsServerManagedSpaces(t *testing.T) {
+	for _, enabled := range []bool{true, false} {
+		cfg := defaults.FullDefaultConfig()
+		cfg.Commons = &shared.Commons{}
+		cfg.ServerManagedSpaces = enabled
+
+		rcfg, err := FrontendConfigFromStruct(cfg, log.NopLogger())
+		require.NoError(t, err)
+
+		got := dig(t, rcfg, "http", "services", "ocs", "capabilities", "capabilities", "spaces")["server_managed"]
+		require.Equal(t, enabled, got)
+	}
+}
+
 func dig(t *testing.T, m map[string]any, keys ...string) map[string]any {
 	t.Helper()
 	for _, k := range keys {